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REMARKS 

In response to the Office Action mailed on June 18, 2007, Applicant 
respectfully requests reconsideration. Claims 1-8, 11-30 and 33-46 are now 
pending in this Application. Claims 1, 20, 24 and 40-43 are independent claims 
and the remaining claims are dependent claims. In this Amendment, claims 1 , 5, 
20, 24 and 40-43 have been amended. Applicant(s) believe that the claim(s) as 
presented are in condition for allowance. A notice to this affect is respectfully 
requested. 

Claims 1-8, 1 1-30 and 33-46 have been rejected as nonstatutory under 35 
U.S.C. §101. Referring to Independent claims 1 , 20, 24 and 40-43, the claimed 
subject matter refers to a data access transaction (request) and resulting data 
access transaction (response) in a query system such as an SQL database 
management system. As is known in the art, a SQL (or any database 
management system) receives queries indicative of entries in the database, and 
returns responses satisfying such queries, either directly to a user or indirectly to 
a requesting application which in turn performs some activity or processing on 
behalf of a requesting user. Accordingly, it is apparent that the data access 
response is a tangible output of the system. Nonetheless, applicant has further 
clarified this aspect by amending claim 1 to recite that y-iv, : . . 

transactlQ.n.l is l.rMu as disclosed 

in the specification at page 6, line 1 1 -page 7, line 2. Independent claims 20, 24 
and 40-43 have been similarly amended. Further, claims 41 and 42, rejected as 
computer readable media, have been further amended to recite a -\ ^ ^ 
instructionsjesponsiyejfi v. ^ 

the. processor, cause the computer lo f. ^ Accordingly it is 

respectfully requested that the rejection under 35 U.S.C. §101 be withdrawn. 

Claims 1, 5, 6, 8, 11-12, 15, 17-19, 24, 28-29, 33-35, 38-39 and 42-46 
have been rejected under 35 U.S.C. §103(a) as being obvious over Fischer, U.S. 
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Patent No. 6,085,191 (hereinafter Fischer '191) in view of Hippelainen, U.S. Pub. 
No. 2002/0078384 (hereinafter Hippelainen '384). 

The Office Action indicates that certain claimed features corresponding to 
conditional execution are not considered to serve as distinguishing over prior art. 
Applicant submits that the conditional "if language corresponds to a set of 
computer program instructions for conditionally performing certain instructions. 
Such instructions are nonetheless present in the computer program and 
therefore define a patentable feature of the claimed method. Since the method 
applies to a persistent data repository, Applicant submits that such a method 
necessarily is performable by a computer. However, in the interest of furthering 
the case to allowance, Applicant has amended claim 1 to remove the conditional 
language. 

Accordingly, Claim 1 has been herein amended to recite "determining a 
correspondence of the intercepted data access transaction to a security policy", 
and " selectively limiting, based on the determined correspondence to the security 
policy", to clarify the alleged conditional limitations. Claim 1 has been further 
amended to recite that the claimed repository is a "persistent u data 
repository", to refine the subject matter as pertaining to a method performable by 
a computer. Similar notations regarding alleged "intended use" elements has 
also been refined, such that claim 1 now recites "padding the packets to emulate 
packers having a corresponding length as the restricted data items." to further 
clarify the invention expressed in claim 1 . Claims 20, 24 and 40-43, having 
similar conditional language, have been likewise amended. 

The Office Action further rejects Claim 1 under 35 U.S.C. §1 03(a) based 
on Fischer '191 in view of Hippelainen '384. For the reasons discussed further 
below, it is believed that Fischer '191 does not show, teach or disclose, either 
alone or in combination, the subject matter recited in Claim 1 . 

Fischer '191 teaches access based security, which focuses on the 
attributes (privileges) of the accessor (i.e. user). In contrast, the claimed 
invention performs data level security, which focuses on the nature of the data 
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content in determining whether access should be granted. In other words, 
Fischer is concerned with WHO is accessing the data (col. 3, lines 29-42), while 
the present application addresses WHAT is being accessed. 

In further distinction, the claimed invention performs nonintrusive 
monitoring, while Fischer is further distinguished from the claimed method 
because Fischer '191 operates in a primary server 150, intrusively impacting 
transaction throughput. The Fischer approach incorporates an access control 
tree exchange that burdens all data access transactions with privilege/rights 
checks (col. 5:15-31), while the claimed nonintrusive monitoring observes 
transactions from the access path or stream, without interfering or manipulating 
the transmission unless intervention is warranted by the passing data. Fischer 
teaches a system in which the access control procedure replaces the intended 
recipient (col. 28, lines 2-12); it does not sniff and intercept in a nondestructive 
manner, as recited in claim 1 . In clarification. Claim 1 has been amended to 
recite that the nonintr usive manner qatherfs] the data access transaction from a 
^l . \^ ^ 0 ^ ihe application and the data repository, as disclosed at 
page 10, lines 3-12. 

The Office Action further cites Hippelainen '384 for the purpose of 
disclosing padding of packets ([0038]). Hippelainen, however, is inapplicable to 
either Fischer or to the present system because the Hippelainen approach 
involves a separate node for which packets are duplicated and sent, along with 
"fake" packets, as disclosed at [0031] and [0061]. Accordingly, one of skill in the 
art would not look to Hippelainen to modify Fischer '191 because, as shown 
above, Fischer is an integrated primary server having an access control tree, and 
does not involve a remote node for sending duplicated (copied) packets to. 
Further, even if one were to attempt to combine Hippelainen with Fischer, the 
result would be inoperable because Fisher has no destination for the copied, 
duplicate packets and the result would certainly not anticipate the claimed 
approach because there the copied packets yield no stream to non intrusively 
monitor. 
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To further distinguish the claimed feature of padding, Claim 1 has been 

herein amended to recite that the padding .em.uJ.ateJs] " o c> ^ x^. 

v.. V. ^ . V. -■^ .^-^ ^ V. v * ' I, as disclosed at page 7, lines 
14-20, so ihai ihe recipient receives a Transaction of the expected length and 
format. This differs from the Hippelainen approach, which always pads to the 
maximum length [0038]. Still further, Claim 1 has been amended with the subject 
matter of claim 5, to clarify the padding approach by reciting identifying rows in 
t'->(^ r'><s!^^tq havinq ""e^^fncted d''*a t<="^N '^•^d c - ''^^ \ ^ ^ om 

the data access transactson such that the resiminq data access transaction is a 

to further 

distinguish Claim 1. Claims 1, 24, and 43, rejected on similar grounds, have 
been likewise amended and are also believed allowable for the reasons given 
above. 

Claims 20-23, 36 and 40-41 have been rejected under 35 U.S.C. §1 03(a) 

as being obvious over Fischer, U.S. Patent No. 6,085,191 (hereinafter Fischer 
'191 ) in view of Slutz, U.S. Patent No. 6,581 ,052 (hereinafter Slutz '052). Claims 
20, 40, and 41 have been herein amended according to the above discussion 
with respect to Fischer '191 . With respect to Slutz '052, Slutz is directed to test 
equipment for databases, not non-intrusive data level processing, as claimed in 
the present system. Accordingly, one of skill in the art would not look to Slutz 
'052 to modify Fischer '191 . Such test equipment is not concerned with, and 
does not show, teach, or disclose, nonintrusive monitoring as claimed. Such 
non-intrusive monitoring avoids impacting performance from processing used to 
process the transactions, and is of little concern in a test system as in Slutz. 
Claims 20, 40 and 41 have been amended to clarify this nonintrusive nature of 
the claimed processing. Accordingly, it is respectfully requested that the 
rejection under 35 U.S.C. §1 03(a) be withdrawn. 
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As the remaining claims depend from, either directly or indirectly, claims 1 , 
20, 24 and 43, it is respectfully submitted that all claims in the case are now in 
condition for allowance. 

Applicant(s) hereby petition(s) for any extension of time which is required 
to maintain the pendency of this case. If there is a fee occasioned by this 
response, including an extension fee, that is not covered by an enclosed check, 
please charge any deficiency to Deposit Account No. 50-3735 . 

If the enclosed papers or fees are considered incomplete, the Patent 
Office is respectfully requested to contact the undersigned collect at (508) 616- 
9660, in Westborough, Massachusetts. 

Respectfully submitted. 
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Christopher J. Lutz, Esq. 
Attorney for Applicant(s) 
Registration No.: 44,883 
Chapin Intellectual Property Law, LLC 
Westborough Office Park 
1700 West Park Drive 
Westborough, Massachusetts 01581 
Telephone: (508)616-9660 
Facsimile: (508)616-9661 
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